Rich Megginson wrote:
On 02/24/2014 09:00 AM, thierry bordaz wrote:
> Hello,
>
> IPA team filled this ticket
>
https://fedorahosted.org/389/ticket/47553.
>
> It requires an ACI improvement so that during a MODDN a given
> user is only allowed to move an entry from one specified part of
> the DIT to an other specified part of the DIT. This without the
> need to grant the ADD permission.
>
> Here is the design of what could be implemented to support this
> need
>
http://port389.org/wiki/Access_control_on_trees_specified_in_MODDN_operation
>
> regards
> thierry
>
Since this not related to any Red Hat internal or customer
information, we should move this discussion to the 389-devel list.
Hi Thierry,
Your design looks good. A minor question. The doc does not mention
about "deny". For instance, in your example DIT, can I allow
"moddn_to"
and "moddn_from" on the top "dc=example,dc=com" and deny them on
"cn=tests". Then, I can move an entry between cn=accounts and staging,
but not to/from cn=tests? Or "deny" is not supposed to use there?
Thanks,
--noriko